CVE-2025-61779: Confidential-Containers Trustee

High severity, CVSS 8.7. EPSS: 0.4% chance of exploitation in the next 30 days.

Confidential Containers's Trustee project contains tools and components for attesting confidential guests and providing secrets to them. In versions prior to 0.15.0, the attestation-policy endpoint didn't check if the kbs-client submitting the request was actually authenticated (had the right key). This allowed any kbs-client to actually change the attestation policy. Version 0.15.0 fixes the issue.

Affected products

• Confidential-Containers Trustee: before 0.15.0 (fixed in 0.15.0)

Published 2025-10-09. Last modified 2026-10-08.